CVE-2022-24682

Katalog CVE

CVSS 6.1 · Medium KEV · sudah dieksploitasi Dipakai ransomware EPSS 30,9%

Kerentanan Improper Encoding or Escaping of Output pada synacor zimbra collaboration suite. Skor CVSS 3.1 6.1 (Medium) menurut NVD. Masuk katalog KEV CISA pada 25 Februari 2022, artinya sudah terbukti dieksploitasi. Tercatat dipakai dalam kampanye ransomware.

Deskripsi (NVD)

An issue was discovered in the Calendar feature in Zimbra Collaboration Suite 8.8.x before 8.8.15 patch 30 (update 1), as exploited in the wild starting in December 2021. An attacker could place HTML containing executable JavaScript inside element attributes. This markup becomes unescaped, causing arbitrary markup to be injected into the document.

Rincian

Terbit di NVD

9 Februari 2022

Terakhir diubah

7 Agustus 2026

Status NVD

Analyzed

CVSS 3.1

6.1 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-116: Improper Encoding or Escaping of Output

EPSS (30 hari)

30,9% peluang dieksploitasi; lebih tinggi dari 98,2% CVE lain

Known Exploited Vulnerabilities (CISA)

Nama

Synacor Zimbra Collaborate Suite (ZCS) Cross-Site Scripting Vulnerability

Masuk KEV

25 Februari 2022

Tenggat CISA

11 Maret 2022 (untuk instansi federal AS)

Ransomware

Tercatat dipakai dalam kampanye ransomware

Tindakan wajib

Apply updates per vendor instructions.

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://blog.zimbra.com/2022/02/hotfix-available-5-feb-for-zero-day-exploit-vulnerability-in-zimbra-8-8-15/ advisory vendor
• https://wiki.zimbra.com/wiki/Security_Center advisory vendor
• https://wiki.zimbra.com/wiki/Zimbra_Releases/8.8.15/P30 release notes · advisory vendor
• https://wiki.zimbra.com/wiki/Zimbra_Security_Advisories advisory vendor
• https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2022-24682 pemerintah AS
• https://www.volexity.com/blog/2022/02/03/operation-emailthief-active-exploitation-of-zero-day-xss-vulnerabilit... exploit · advisory pihak ketiga